# Clause 8.3.3: Selection of strategies and solutions

Choose among the candidates identified according to how far they meet the time frames and the capacity agreed, suit how much risk, and of what kinds, the organization is willing to accept, and hold up when their costs are weighed against their benefits.

Cloud: Selection is a trade between recovery time, cost and operational complexity. Record why the chosen option was preferred, because a later reviewer will otherwise assume the cheapest option was chosen by default.

Evidence: Selection decision record naming the three selection factors; Statement of the risk the organization is prepared to take that the decision was judged against; Cost and benefit analysis behind the chosen solution; Approval by the authority able to accept the residual exposure.

Test: Record the reason each strategy was selected over the alternatives.

Citation: ISO 22301:2019, clause 8.3.3. Source: https://compliance.theartofservice.com/frameworks/iso-22301-2019. Last updated: 2026-10-20.